web3-core-js@1.0.0

package.json declares a lifecycle hook that invokes require('child_process') and execSync with a curl command at install time. This pattern fetches remote content and executes it on the installer's machine as part of `npm install`, before any user code runs. The package name mimics the widely-used web3/web3-core ecosystem while shipping only a lifecycle trigger for remote execution — no library code consistent with the claimed web3 purpose is present. Running `npm install web3-core-js` on any developer or CI machine results in arbitrary attacker-controlled bytes being fetched and executed with the privileges of the installing user. ## Source: ossf-package-analysis (44e1f40536600c94540b0fd722439856b2f118f6090709db7461f5aa06fc2fb4) The OpenSSF Package Analysis project identified 'web3-core-js' @ 2.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.